Windows Suspicious Process Execution Using GUID-Like Folder Names in %TEMP% or AppData
Hunts Windows processes whose command lines reference GUID-named folders in user AppData/Temp locations.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-09-01
- Updated
- 2026-07-31
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process creation events where the command line contains a GUID-like folder pattern ("{...}" followed by a backslash) and the activity also references suspicious user-writable locations such as AppData\Roaming or AppData\Local\Temp. GUID-named temporary folders are commonly used to stage or execute payloads from transient directories, helping attackers blend in with seemingly random filesystem artifacts. It relies on Windows process creation telemetry, matching process command lines and excluding specific installer-related execution patterns based on the image path.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Suspicious Process Execution Using GUID-Like Folder Names in %TEMP% or AppData
id: d69f74a9-768d-444a-9c46-5326fc85d90b
status: test
description: This rule flags process creation events where the command line contains a GUID-like folder pattern ("{...}" followed by a backslash) and the activity also references suspicious user-writable locations such as AppData\Roaming or AppData\Local\Temp. GUID-named temporary folders are commonly used to stage or execute payloads from transient directories, helping attackers blend in with seemingly random filesystem artifacts. It relies on Windows process creation telemetry, matching process command lines and excluding specific installer-related execution patterns based on the image path.
references:
- https://twitter.com/Kostastsale/status/1565257924204986369
- https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_susp_execution_from_guid_folder_names.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-09-01
modified: 2023-03-02
tags:
- attack.stealth
- attack.t1027
- detection.threat-hunting
logsource:
category: process_creation
product: windows
detection:
selection_folder:
CommandLine|contains:
- \AppData\Roaming\
- \AppData\Local\Temp\
selection_guid:
CommandLine|contains|all:
- \{
- "}\\"
filter_main_image_guid:
Image|contains|all:
- \{
- "}\\"
filter_main_null:
Image: null
filter_main_driver_inst:
Image: C:\Windows\System32\drvinst.exe
filter_main_msiexec:
Image:
- C:\Windows\System32\msiexec.exe
- C:\Windows\SysWOW64\msiexec.exe
condition: all of selection_* and not 1 of filter*
falsepositives:
- Installers are sometimes known for creating temporary folders with GUID like names. Add appropriate filters accordingly
level: low
license: DRL-1.1
related:
- id: 90b63c33-2b97-4631-a011-ceb0f47b77c3
type: derived